Researchers Release Detection Tool For Gauss Malware's Palida Narrow Font

One of the many mysteries around the discovery of the Gauss malware is why the tool installs a new font called Palida Narrow on infected machines. Researchers have been unable to figure out yet what the purpose of the font is, but as its presence on a PC is a good indicator of a Gauss infection,...

CVE-2012-1963

The Content Security Policy CSP functionality in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 does not properly restrict the strings placed into the blocked-uri parameter of a violatio...

Microsoft IIS Tilde Character Information Disclosure Vulnerability (HTTP)

The Microsoft IIS Webserver is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Yahoo Patches Vulnerability that Led to 450,000-Password Breach

Yahoo announced today it’s fixed the security hole that allowed a hacker group this week to post some 450,000 email addresses and passwords belonging to freelance writers. “We have taken swift action and have now fixed this vulnerability, deployed additional security measures for affected Yahoo!...

Microsoft IIS Authentication Bypass and Source Code Disclosure Vulnerabilities

Microsoft IIS is prone to an authentication-bypass vulnerability and a source-code disclosure vulnerability because it fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C...

Microsoft FrontPage Server Extensions MS-DOS Device Name DoS Vulnerability (Aug 2000)

Microsoft FrontPage Server Extensions is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ajp-brute NSE Script

Performs brute force passwords auditing against the Apache JServ protocol. The Apache JServ Protocol is commonly used by web servers to communicate with back-end Java application server containers. Script Arguments ajp-brute.path URL path to request. Default: / creds.service, creds.global See the...

Sockso <= 1.51 XSS Vulnerability - Active Check

Sockso is prone to persistent cross-site scripting XSS vulnerability. Copyright C 2012 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

IAA, Redirector and XSS vulnerabilities in WordPress

Hello 3APA3A! I want to warn you about security vulnerabilities in WordPress. These are Insufficient Anti-automation, Redirector and Cross-Site Scripting vulnerabilities. ------------------------- Affected products: ------------------------- Vulnerable are WordPress 2.0 - 3.3.1. ---------- Detail...

FreeBSD Ports: firefox

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2012 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

nginx 'ngx_cpystrn()' Information Disclosure Vulnerability

nginx is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nginx:nginx"; if...

nginx 'ngx_cpystrn()' Information Disclosure Vulnerability

nginx is prone to an information-disclosure vulnerability. Attackers can exploit this issue to harvest sensitive information that may lead to further attacks. OpenVAS Vulnerability Test $Id: gbnginx52578.nasl 5988 2017-04-20 09:02:29Z teissa $ nginx 'ngxcpystrn' Information Disclosure Vulnerabili...

Oracle Service Applications SQL Injection

Title: ====== Oracle Service Applications - SQL Injection Vulnerabilities Date: ===== 2012-04-12 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=478 VL-ID: ===== 478 Introduction: ============= Oracle Corporation NASDAQ: ORCL is an American multinational computer...

Oracle Service Applications - SQL Injection Vulnerabilities

Document Title: =============== Oracle Service Applications - SQL Injection Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=478 Release Date: ============= 2012-04-11 Vulnerability Laboratory ID VL-ID: ====================================...

Oracle Service Applications - SQL Injection Vulnerabilities

Document Title: =============== Oracle Service Applications - SQL Injection Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=478 Release Date: ============= 2012-04-11 Vulnerability Laboratory ID VL-ID: ====================================...

Mozilla Firefox Bootstrapped Addon Social Engineering Code Execution

Mozilla Firefox before version 41 allowed users to install unsigned browser extensions from arbitrary web servers. This module dynamically creates an unsigned .xpi addon file. The resulting bootstrapped Firefox addon is presented to the victim via a web page. The victim's Firefox browser will pop...

WebGlimpse command injection vulnerability

Overview Webglimpse, a web site search application, contains a command injection vulnerability. Description The webglimpse.cgi script contains a command injection vulnerability. An attacker can use a specifically crafted query URL parameter to run system commands. The results of the command will ...

Web servers multiple IMAP initial connection requests denial of service

A denial of service vulnerability has been reported in all web servers. The vulnerability is due to the server's inability to handle multiple incoming IMAP requests within a short period of time. Remote attackers may exploit this issue by rapidly sending a large number of IMAP requests to the...

Fedora Update for rubygem-rack FEDORA-2012-0166

Check for the Version of rubygem-rack OpenVAS Vulnerability Test Fedora Update for rubygem-rack FEDORA-2012-0166 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

CVE-2012-0451

CRLF injection vulnerability in Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 allows remote web servers to bypass intended Content Security Policy CSP restrictions and possibly conduct...